Cloud-based solution keeps card data out of merchant environments, reducing the scope of PCI compliance and maintaining encryption from point of swipe to gateway arrival

Article originally appeared in The Green Sheet Issue 110901

High-level integration, synchronization

A ccording to company President Greg Hammermaster, Sage Payment Solutions, a division of Sage North America, is an unusual amalgam: it is both a software developer and a merchant services firm. In practical terms, that means it is not an intermediary selling various products to its ISOs and merchants, but rather a company that sells its own payment solutions. That combination yields two major benefits, according to Hammermaster:

The company's products are cheaper because they lack the markup necessitated by an extra player on the chain.

The company and its ISOs can cultivate more intimate and efficient relationships with their merchants by responding more quickly to inquiries or requests, automatically providing technology upgrades and seamlessly integrating new features to merchant POS systems.

Confusion and bureaucracy diminish when a merchant's payment provider not only sells that merchant the technology, but can also help him or her manage it without the assistance of a third party, Hammermaster said.

"Sage is really the only global software company that's this focused on payments from the commercial side," Hammermaster said. "Google and Apple are playing with consumer-based payments, but we're talking about a commercial enterprise provider saying, 'You're who we serve, and we want to make your business life easier.'"

Sage's merchant services platform revolves around an idea that some might find counterintuitive: merchants can maximize profitability by devoting less time to managerial tasks, not more.

For merchants contracted with Sage - as well as for the affiliated resellers through which Sage sells about 70 percent of its merchant services products - the focus is on developing and integrating tools that can boost merchant profits while minimizing the stress and complexity of the operating environment, Hammermaster said.

According to Hammermaster, reduced costs and higher revenues are the common corollary of a cloud-based Sage software program that consolidates, automates, updates, streamlines, and simplifies the work of payment acceptance and business management.

Sage Exchange

"Our interest is making our customers' business lives easier, and to us that means looking for ways to get paid faster, to reduce their processing costs, to increase sales channel revenue," Hammermaster said. "What it really comes down to is the integration of their back-office software.

"We've developed a platform called Sage Exchange, and we've connected to this platform all the different information channels a merchant deals with and automated it with electronic data and updates."

He added that small business owners today almost need a Ph.D just to open their doors, and payment professionals need to be more helpful. "They're trying to figure out their payroll tax, and we're just adding our acronyms and PCI," he said. "When a business is dealing with an automatized, electronic data system and not doing things manually, it really helps simplify how they get to where they want to be in terms of growing their business."

Hammermaster said merchants save as much as five minutes per transaction through automating tasks commonly done manually (for example, tabulating the day's receivables from a stack of paper receipts).

Sage Exchange performs and automates tasks that range from totaling receivables to managing inventory and sending invoices. It also crunches and aggregates numbers for franchises that sell from multiple locations and businesses that use varied payment acceptance methods, for example, merchants who sell from a brick-and-mortar environment but also take payments on electronic or mobile commerce platforms.

SaaS advantages

It is the software-as-a-service (SaaS) aspect of Sage Exchange that allows all of it to happen, Hammermaster said. For one, merchants are not saddled with a complicated program that can weigh down POS networks and force them into a troubleshooting role if something goes awry. All of the technical work is handled by Sage, with the program residing on the company's server. Thus Sage feels merchants enjoy the best of both worlds: a whole suite of features from a software program and no worries about maintenance, upgrades or technical oversight.

Back-end business management is growing increasingly complicated, as more and more merchants take up different forms of payment acceptance, in particular mobile payment acceptance, and expand their payment acceptance options with each device. Options can include credit and debit card, check, automated clearing house, and gift card payments, as well as increasingly popular online alternative payments (enabled by such businesses as Bill Me Later Inc.) and, for business-to-business transactions, e-procurement services.

Merchants using Sage Exchange can track, in real time, both the progress of the day's receivables and outgoing money related to things like inventory purchases, bank and network fees, and invoice-based payments to employees, Hammermaster said. With such a spectrum of transaction data aggregated into one place, business owners and managers can see a complete financial picture at any point in time.

Merchant tools

Merchants can view their disparate data streams separately and parse them in numerous ways: by sales at a particular location, sales with mobile terminals, sales of high-ticket items, etc. They can also aggregate all of the data to obtain a broad, overall picture of the company's financial standing.

"These reports are highly configurable," Hammermaster said. "As a merchant, you can choose the fields you want to activate. You can look at it by ZIP code, by dollar amount ... it allows you to pick and choose what you run your reports on, and there's a lot more visibility with cash management."

Another benefit of Sage's SaaS solution is the ease and efficiency with which merchants can add new features or otherwise upgrade their networks. General updates to merchant POS systems happen automatically and seamlessly, as opposed to requiring merchants to take proactive action anytime they want a terminal update, Hammermaster said.

Also, merchants who want to add features can send in a request through the software program and have the new feature incorporated almost instantaneously. Again, all the work is done at Sage's end; merchants need only submit a request, and the software enhancement flows in automatically.

Hammermaster said Sage is helping merchants create enterprise resource planning. "So when a business says, 'I just want to start with the payment device now, and then later they want to add six other solutions,' those can be integrated seamlessly at any point in time," Hammermaster said.

Front-end features

Hammermaster added that Sage is expanding its front-end features as well. For example, with the company's newer terminals, merchants can deploy receipt-based couponing and advertising. And they can acquire that capability with the same ease and efficiency that they do with everything else on Sage Exchange. Again, the feature addition is sent in remotely from Sage's server and seamlessly integrated.

"An [Internet Protocol]-based terminal gives you two-way capability," Hammermaster said. "They can say, 'I want this printed on the receipt,' and we can instantly change it into an ad or coupon in a matter of a nanosecond."

For merchants, the POS system offered by Sage is textured in such a way that it appears to reside on a merchant's own network, Hammermaster said. In fact, everything with Sage Exchange is cloud-based; nothing runs through the merchant's environment. All transactions flow immediately into the cloud-based software channels run by Sage and remain in Sage's network until they reach their gateway destination.

Data security

Hammermaster said that by removing all data from the merchant environment, the scope of merchants' Payment Card Industry (PCI) Data Security Standard (DSS) compliance responsibility is greatly diminished; this is not to mention the more fundamental problem of stolen payment information. Payment data that sits or travels through merchant proprietary POS systems is statistically more vulnerable than data that circumvents the merchant's environment.

Hammermaster added that Sage approaches data security from two angles: prevention and detection. On the prevention end, the data is routed away from the merchant environment and subject to end-to-end encryption, or what Hammermaster calls swipe to settlement (s-to-s) encryption. This type of encryption begins at the point of swipe and is maintained until it gets to its next destination at the merchant's gateway provider.

On the detection side, Sage has a partnership with information security company Trustwave Inc. through which they offer a "sniffer" that combs payment networks for potential invaders such as spyware on a personal computer, Hammermaster said.

He added that Sage has lent special focus to mobile payment security, an area that is not yet subject to PCI regulations. This absence of PCI guidance and the fact that personal cell phone networks are always on and open (unlike dedicated phone line terminals), mean mobile payments present a particularly difficult security challenge, he noted.

"We've had different PCI breaches in the press that have been more at arm's length from the consumer," Hammermaster said. "Now, if a consumer hears about a mobile attack and it's widespread, that becomes more intimate and personal for the average consumer, who always carries a mobile phone."

Hammermaster said his "biggest fear, now that we're in the mobile payments game, is a lack of PCI guidance and a haphazard approach" he has seen from mobile technology and payment providers. To safeguard sensitive data, Sage uses the same security standards, such as s-to-s encryption and attachable swipe devices, with mobile payment acceptance that it does with every other payment medium it offers, he noted.

Flexibility and synergy

Sage believes having its own technology suite enables it to be flexible, meeting new market demands with products of its own making. According to Hammermaster, mobile payments present the most daunting new challenges, especially because they lend themselves to small businesses that might not otherwise pay for traditional terminal-based card processing.

Sage keeps a particularly close eye on such businesses; its focus is small and midsize businesses. "We are a global business software company that serves businesses with 1,000 employees or less," Hammermaster said. "Every day they're trying to make business better, and we can integrate sales channels that open new revenue opportunities and bring down their expenses.

"With all our solutions, there's tremendous DNA on the software side to give to the payments side and vice versa. For our customers, it's not just a payments process but a software process, and using those two things together to maximize the advantages our clients have. It's chocolate and peanut butter coming together." Launches

Notice to readers: These are archived articles. Contact names or information may be out of date. We regret any inconvenience.